In this paper we present a novel intrusion detection architecture based on Idiotypic Network Theory (INIDS), that aims at dealing with large scale network attacks featuring variab...
Marek Ostaszewski, Pascal Bouvry, Franciszek Sered...
Most intrusion detection systems apply the misuse detection approach. Misuse detection compares recorded audit data with predefined patterns denoted as signatures. A signature is ...
Alert correlation is an important technique for managing large the volume of intrusion alerts that are raised by heterogenous Intrusion Detection Systems (IDSs). The recent trend ...
Considerable research has been done on detecting and blocking portscan activities that are typically conducted by infected hosts to discover other vulnerable hosts. However, the f...
We map intrusion events to known exploits in the network attack graph, and correlate the events through the corresponding attack graph distances. From this, we construct attack sc...